Certified Secure Software Lifecycle Professional (CSSLP)

 I have passed the exam and endorsement process and officially CSSLP certified now!

Passed SC-300

 Last exam of the year, SC-300!

Execute PowerShell in Windows Scheduled Task

 There are many ways to execute PowerShell in Windows scheduled tasks:

Option #1

Program/Script: PowerShell.exe

Add arguments (optional): -command "& {& 'C:\path\to\script.ps1'}"

Start in (optional): C:\path\to\

Option #2

Program/Script: PowerShell.exe

Add arguments (optional): -NonInteractive -Noprofile -File "C:\path\to\script.ps1"

Start in (optional): C:\path\to\

Option #1 allows me to have the script to connect to the Internet (server is located behind corporate proxy). 

Passed AZ-303

 It is official! after passing AZ-303 today, I am now a Microsoft Certified Azure Solutions Architect Expert.

Passed AZ-304

 Today, I passed AZ-304 exam ! 

One more to go to get Azure Solution Architect Expert

http://aka.ms/AzureCerts_SolutionsArchitect

Microsoft Azure Administrator Associate

 Passed AZ-104 exam today!! 

I am now officially Microsoft Azure Administrator Associate certified!! 

Microsoft Certified: Azure Security Engineer Associate

 Passed AZ-500 today!!

Hyper-V Nested VM

To allow your VM to run Hyper-V role, you need to expose the virtualization extension to the Hyper-V host by running the following PowerShell command:

> Set-VMProcessor -VMname MyVM -ExposeVirtualizationExtensions $true

My QNAP TS-412 had a major issue, 2 of the RAID5 disks decided to fail at the same time. Luckily QNAP was still up and running and allow READ-ONLY access to my data. However, all the iSCSI LUNs are not accessible anymore from my iSCSI clients.

Found the attached document which basically helped me recover my iSCSI LUNs. I copied by iSCSI LUN files to the backup locations and rebuild by NAS volumes. I then follow the procedure #3 in the document to get my iSCSI LUNs back.

Ubuntu DNS Stub Listener #Disable

During setting up PiHole, it requires to listen on DNS (53/TCP, 53/UDP) on the host. Ubuntu version that I am running on (20.04) by default listens on port 53 because it runs as DNS Stub Listener.

PiHole will give errors about Binding error

To disable Ubuntu running as DNS Stub Listener, do the followings:

> sudo vi /etc/systemd/resolved.conf 

un-comment #DNSStubListener=yes 
change it to DNSStubListener=no

> sudo service systemd-resolved restart
> sudo systemctl disable systemd-resolved.service
> sudo systemctl stop systemd-resolved
> sudo mv /etc/resolv.conf /etc/resolv.conf.old
> sudo shutdown -h now -r

Passed AZ-900 Exam Today!

Officially Microsoft Certified Azure Fundamentals !!

Microsoft Ignite 2020

PowerShell and Excel

I wrote a PowerShell script to start MS Excel process and manipulate an Excel file. This PS works perfectly fine when it is executed interactively by a user account. However when using Windows task scheduler, it throws the following errors:

Microsoft Excel cannot access the file
There are several possible reasons:
The file name or path does not exist.
The file is being used by another program.
The workbook you are trying to save has the same name as a currently open workbook.

In turns out, I need to create a directory named: Desktop
In the following locations:

64-Bit OS
C:\Windows\SysWOW64\config\systemprofile\Desktop

32-Bit OS
C:\Windows\System32\config\systemprofile\Desktop

QBE CIO Award 2019

All the hard work is paid for ... QBE Cyber Security team has been recognized for exceptional performance!! 

Tail in PowerShell

 I need to "tail" in PowerShell to view the log and found the following command interesting:

> Get-Content C:\mylog.txt -Wait

If you want to get the latest file and tail it:

> Get-Content ( Get-ChildItem C:\Folder\ | Sort-Object LastWriteTime | Select-Object -Last 1) -Wait

Active Directory Group Policy by Powershell

 Use the following Powershell to get all the GPO dumped to HTML files

#> Get-GPO -All -Domain mydomain.tld | % { Get-GPOReport -Guid $_.Id -ReportType Html -Domain mydomain.tld | Set-Content C:\Reports\$($_.DisplayName).html }

Gartner Security & Risk Management Summit 2019

#GartnerSEC

SailPoint NAVIGATE

Fix Corrupted Windows 10 File(s)

Recently, I had issue with my VM which runs Windows 10 for my daily ops work. The issue was, the hosting machine kept crashing due to unknown issue, thus ungracefully shutting down my Windows 10 VM.

One time, second time, third time were fine. Finally, one day, I wasn't able to open any ZIP file. It looked like the OS lost its association with the file type .ZIP. I went to the default file type program and could not find .zip file type. I then checked my other healthy Windows 10 machine and clearly there is no .zip file type association either.

To fix this I ran:

> sfc /scannow

When the scan was completed, I checked the log file, it had:

Could not reproject corrupted file \??\C:\WINDOWS\System32\\zipfldr.dll; source file in store is also corrupted

What I did next:

> DISM.exe /Online /Cleanup-image /Restorehealth

Then

> sfc /scannow

and I can open ZIP files again!! :)

C# + Active Directory = Awesome!!

I have a need to review AD groups and local admin groups as part of the identity project -  to identity users who are having privileged access in AD or servers. I developed this tool to help with the quick search, detailed view, export, etc with UI.

Obviously this can be done with PowerShell, but I found there is limitation with PowerShell in regards to recursive lookup especially when dealing with foreign objects

As you can see below, there are different account type you can query, user, computer and group (with recursive option). You can also provide a different credential to query Active Directory as well as specifying a particular OU, LDAP filter and keyword doing the search.

  

The below UI provides the interface to query local groups in Windows machine. You can specify a single computer, computers in a particular OU or a text file containing a list of computers.